Upper bounds of eavesdropper's performances in finite-length code with decoy method 
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Security formulas of quantum key distribution (QKD) with imperfect resources are obtained for 
finite-length code when the decoy method is applied. This analysis is useful for guaranteeing the 
security of implemented QKD systems. Our formulas take into account the effect of the vacuum 
state and dark counts in the detector. We compare the asymptotic key generation rate in presence 
of dark counts with that without. 
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I. INTRODUCTION 

The BB84 protocol proposed by Bennett and 
Brassard[l] in 1984 attracts attention as an alternative to 
modern cryptography based on complexity theory. Many 
efforts are devoted to searching for implementations of 
quantum communication channels for this purpose. The 
security of the original BB84 protocol can be trivially 
proved only when the quantum communication channel is 
noiseless. Since there is noise in any implemented quan- 
tum channel, it is needed to prove the security with the 
noisy channel, which has been proved by Mayers [2| . After 
his proof, many different proofs were reported. However, 
any implemented quantum channel, besides loss, also suf- 
fers imperfections in generating a single photon. That is, 
the sent pulse is given as a mixture of the vacuum state, 
the single-photon state, and the multi-photon state, and 
it is impossible for the sender (Alice) and the receiver 
(Bob) to identify the number of photon. In order to 
guarantee the security in such a case, the decoy method 
has been proposed [H 0, H, @, in which different kinds 
of pulses are transmitted. However, these preceding re- 
searches did not provide security with the finite-length 
code, which is a basic requirement in practical settings. 
That is, there is no established method to evaluate quan- 
titively the security of an implementable quantum key 
distribution (QKD) system. 

On the other hand, modern cryptographic methods are 
required to evaluate its security quantitively. Hence, for 
the practical use of QKD, it is needed a theoretical analy- 
sis in order to present quantitive criteria for security and 
to establish the method to guarantee this criteria for the 
implemented QKD system. If nothing in this direction 
is done, QKD systems cannot be developed for practical 
use. 

In a usual QKD protocol, the final key is generated via 
classical error correction and privacy amplification after 
the initial key (raw key) is generated by the quantum 
communication. In the classical error correction part, it 
is sufficient to choose our classical error correction code 
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based on the detected error rate. Privacy amplification, 
on the other hands, sacrifices several keys in order to 
guarantee the security against the eavesdropper. The 
upper bound of eavesdropper(Eve)'s information for the 
final key is closely related to the amount of sacrifice bits. 

Since Eve's information for the final key is the measure 
of the possibility of eavesdropping, its quantitive evalua- 
tion is required. In order to decrease Eve's information 
sufficiently, we need a sufficient amount of sacrifice bits, 
which is given by the product between the length of our 
code and the rate of sacrifice bits. A larger size of our 
code requires larger complexity of the privacy amplifi- 
cation, and a larger rate of sacrifice bits decreases the 
generation rate of the final key. Hence, it is required to 
derive the formula to calculate the upper bound of Eve's 
information for the final key for a given length of the 
code and a given rate of sacrifice bits, under the realiz- 
able quantum communication channel. 

Our problems can be divided into three categories: The 
first is the evaluation of Eve's information for the given 
length of our code and the given rate of sacrifice bits. 
Since any implemented QKD system has a finite-length 
code, any asymptotic security theory cannot guarantee 
the security of an implemented QKD system. The second 
is the security analysis for imperfect resource (e.g., phase- 
randomized coherent light) that consists of mixtures of 
the vacuum state, single-photon state, and multi-photon 
state. Many practical QKD systems are equipped not 
with single-photon but with weak phase-randomized co- 
herent signals. These systems require a security analysis 
with an imperfect resource. Further, even if a QKD sys- 
tem is approximately equipped with single-photon sig- 
nals, it nonetheless needs a security analysis for an im- 
perfect resource because only a perfect single-photon re- 
source allows the security analysis for the single-photon 
case. The third is the identification of the relative ratio 
among the vacuum state, the single-photon state, and 
the multi-photon state in the detected pulses. Many im- 
plemented quantum communication channels are so lossy 
that Alice and Bob cannot identify this ratio in the de- 
tected pulses even though they know this ratio in the 
transmitted pulses. Thus, they need a method to esti- 
mate this ratio. Each of these three problems has been 
solved only separately, however, an implemented QKD 
system requires a unified solution for these three prob- 
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lems, which cannot be obtained by a simple combination 
of separate solutions. 

Concerning the first problem, many papers treated 
only the asymptotic key generation (AKG) rate. 
Only the papers, Mayers|2j, Inamori-Liitkenhaus- 
Mayers(ILM)0, S.Watanabe-R.Matsumoto- 
UyematsufWMU)[i|, Renner-Gisin-Kraus(RGK)[|, and 
Hayashi[l(| discussed the security of the finite- length 
code with a low complexity protocol. In particular, 
only ILM[tJ takes into account the second problem 
among them, and the other papers treat only the single 
photon case. Extending the method of MayersQ, ILM 
[7j provided an evaluation of the security with imperfect 
resources for the finite-length code. Unfortunately, their 
formula for the security evaluation is so complicated that 
a simpler security bound is needed. They also obtained 
the AKG rate with imperfect resources. Extending the 
method of Shor-Preskilljllj. Gottesman-Lo-Lutkenhaus- 
Preskill (GLLP):12| also obtained this rate. In order to 
solve the third problem, Hwang Q developed the decoy 
method, in which we estimate the ratio by changing the 
intensity of the transmitted phase-randomized coherent 
light randomly. After this breakthrough, applying the 
asymptotic formula by GLLPpjJ, WangQ and Lo et 
al-[Iim analyzed this method deeply, but did not treat 
the security of the finite-length code. Hence, there is 
not enough results to treat the security with the decoy 
method for the finite-length code. 

Further, there is a possibility for an improvement of 
the AKG rate by ILM and GLLPpjJ. Taking into 
account the effect of the vacuum state, Lo[l]| conjec- 
tured an improved AKG rate. Considering the effect of 
the dark counts in the detector, Boileau-Batuwantudawe- 
Laflammc (BBL)[l4| conjectured a further improvement 
of the AKG rate conjectured by Lo[l^]. They pointed 
out that the AKG rate with the forward error correction 
is different from that with the reverse error correction. 

In this paper, in order to evaluate eavesdropper's per- 
formances, we focus on the average of Eve's information, 
the average of the maximum of trace norm between Eve's 
states corresponding to different final keys, and the prob- 
ability that Eve can correctly detect the final key. We 
derive useful upper bounds of these quantities for the 
protocol given in section [H] in the finite-length code by 
use of mixing different imperfect resources. Based on 
this bound, we obtain an AKG rate. In particular, due 
to the consideration of the effect of the dark counts, our 
bound improves that by ILM and it yields the AKG 
rate that coincides with the that conjectured by BBL[l3|. 
We should mention here that our description for quan- 
tum communication channel is given as a TP-CP map on 
the two-mode bosonic system. Since our results can be 
applied to the general imperfect sources, it provides secu- 
rity with an approximate single-photon source. However, 
further statistical analysis is required for the numerical 
bound of Eve's information for implemented QKD sys- 
tem with the finite-length code. Such an analysis is pre- 
sented in another paper [lj|. Also, the analysis of the 



AKG rate in the case of phase-randomized coherent light 
will be presented in another paper [l(|. 

The paper is organized as follows. In section [H] as a 
modification of BB84 protocol, we present our protocol, 
in which we clarify the measuring data deciding the size 
of sacrifice bits in the privacy amplification. In section 
IIII1 we derive upper bounds of the averages of Eve's in- 
formation about the final key and of the trace norm of 
the maximum between Eve's states corresponding to dif- 
ferent final keys under the protocol given in section [TTJ In 
section IIV1 we characterize the AKG rate based on our 
bounds, and apply it to the case of mixture of the vac- 
uum and the single-photon and the case of approximate 
single-photon. In Section |V1 the quantum communica- 
tion channel is treated as a general TP-CP map on the 
two-mode bosonic system. It is proved that such a gen- 
eral case can be reduced to the case given in section Hill 



II. MODIFIED BB84 PROTOCOL WITH 
DECOY STATE 

We consider BB84 protocol based on + basis, | f), II) 
and x basis, |+) := ^(| T) + 1 D), R := ^(1 T) - 1 !»■ 
If we realize this protocol by using photon (or bosonic 
particle), we have to generate single-photon in the two- 
mode system and transmit it without no loss. How- 
ever, it is impossible to implement this protocol per- 
fectly, any realized quantum communication system can 
send only an imperfect photon (or approximately single- 
photon). Hence, we have to treat bosonic system more 
carefully. Let us give its mathematical description. Two- 
mode bosonic system is described by H := (B^ =0 H n , 
where the n-photon system H n is the Hilbert space 
spanned by |0, n), |1, n — 1), . . . , |n — 1, 1), and |n, 0). 
For example, \j, n — j) is the state consisting of j pho- 
tons with the state | f) and n — j photons with the 

state | |). Also the vector E"=o ^/(")(§) n tf.» - j) 

(E"=oVT5)(i)"(-l)"^b> - 3)) corresponds to the 
state of n photons with the state |+) (|— )). That is, the 
system H n is equivalent with the n-th symmetric sub- 
space of two dimensional system. We also denote the 
state of j photons with the state R and n — j photons 
with the state R by \j,n — j, x). 

When we would generate the state | f) in the two- 
dimensional system with the coherent pulse, the gener- 
al 2 

ated state is described by the state E^Lo e ~ l n > ^) 
in the two-mode bosonic system. However, if we 
implement our system so that each phase factor 
9 of the complex amplitude a — yfp.e lB is com- 
pletely random, our state can be regarded as the 

mixed state e _M E^lo 7jl n ' 0) ( n ' 1 , which depends 
only on the intensity /i. In the following, we 
consider a more general case, in which the pulse 
sent by the sender (Alice) are given by Pq + := 
E£=oK»)M><n,0|, pl + := lT=o^)|0R(0,0|, 
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po,x En=oK n )h° 5 x >( n A x l 5 Pi.x := 

^ n=0 z^(n)|0, n, x)(0, n, x I, where v is an arbitrary 
distribution. 

Since our communication channel is lossy, the receiver 
(Bob) cannot necessarily detect all of the sent pulses. If 
the breakdown of the detected pulses (the ratio among 
the vacuum state, the single-photon state, n-photon 
state, and so on) is known, we can guarantee the security 
of BB84 protocol based on the discussion on subsection 
IIIIBI However, since the usual quantum communication 
channel is lossy, there is a possibility that Eve can control 
the loss depending on the number of the photons. Hence, 
it is impossible to identify the the loss of each number of 
the photons if Alice sends the pulse by using one distri- 
bution v. One solution is the decoy method[||, 0, 0, in 
which Alice randomly chooses the distribution v and esti- 
mates the loss and the error probabilities of each number 
state. It is effective to choose the vacuum pulse |0)(0|. 

In the following, we describe our protocol. First, we fix 
the following; the size N of our code, the maximum num- 
ber N and the minimum number N_ of final key size, the 
number N' of sent pulses, the k distributions v\ , . . . , Vk 
of the generated number of photons, and the distribution 
Vi , whose pulse generates the raw keys. Since the vac- 
uum pulse and two bases are available, Alice sends 2fc + 1 
kinds of pulses, where the 0-th kind of pulse means the 
vacuum pulse, the z-th kind of pulse means the pulse 
with the x basis generated by the distribution i^, and 
the i + fc-th kind of pulse means the pulse with the + ba- 
sis generated by the distribution for i = 1, . . . , k. For 
this purpose, they fix the probabilities p , . . . ,p 2 ki an d 
Alice generates i-th kind of pulse with the probability p i 
for i = 0, . . . , 2k. The probabilities p iQ and Pk+i should 
be larger because these generate the pulses producing 
the raw keys. In this paper, we use the bold style for 
describing the vector concerning the index i representing 
the kind of pulse, as p = (p , . . . ,p 2 k)- 

Before the quantum communication, they check the 
probability of dark counts in the detector, and the 
probability ps of errors of the x basis occurred in the 
detector or the generator, which can be measured by 
the error probability when the quantum communication 
channel has no error. Similarly, they the probability ps 
of errors of the + basis occurred in the detector or the 
generator. 

1. Alice sends the N' pulses, where each pulse is 
chosen among 2k + 1 kinds of pulses. She de- 
notes the number of the i-th kind of pulses by Aj. 

2. After sending N' pulses, Alice announces the kind 
of the each pulse (the basis and the distribution v%) 
by using public channel. 

3. Bob records the numbers Co, ... , C 2 k of detected 
pulses and the numbers E\, ... , E 2 k of detected 
pulses with the common basis for each kind i — 
0, . . . , 2k of pulses. Bob announces the positions of 



pulses with the common basis and the above num- 
bers by using public channel. 

4. Alice chooses Ei — N bits among io-th pulses with 
the common basis and Ei 0+ k — N bits among the 
i{) + fc-th pulses with the common basis, and an- 
nounces these positions and their bit by using pub- 
lic channel. Bob records the number of errors as 
Hi Q , Hi 0+ k and announces them by using public 
channel. If Ei < N or Ei 0+ k < N, they stop their 
protocol and return to the first step. 

5. Alice and Bob announce their bit of the remain- 
ing kinds i ^ 0, iq, iq + k of pulses, and record the 
number of error by Hi . 

6. Using these informations, they decide the rates 
^( £ g + fc + -jv ) ano - t i( e H -n ) °f error correction and 
the sizes of sacrifice bits m{T>i,'D e ) and m(T>i,'D e ) 
in the privacy amplification for the remaining 
the io-th kind of pulses and and the io + fc-th 
kind of pulses, respectively, where we abbreviate 
the initial data (A,v,ps,pd) and (A,v,ps,pd) 
and the experimental data (C,E,H) to T>i, 2?j, 
and V e . If Nr)( E f i0 +* N ) - m(V u V e ) < N or 

Nr li E H -N ) ~ ™-(X>i,D e ) < N, they stop their 
protocol and return to the first step. Further, 
if N < Nrj( p Hz " + \ T ) - m(T>i,V e ), they replace 

m(Vi,V e ) by Nr]( E H '^ N )-N. Similarly, if N < 

n v( e"-n ) ~ M^i^e), they replace rh(T> i ,T> e ). 

7. They perform N bits error correction for + basis, 
and generate Nri( E Hl °^ N ) bits. 

8. They perform privacy amplification for the + basis, 
and generate Ntj( F g ' 0+ _^M ) — m(T>i,T> e ) bits. 

9. They perform N bits error correction for the x ba- 
sis, and generate Nr]( E H '° N ) bits. 

10. They perform privacy amplification for the x basis, 
and generate Nrj( g— zjjyO — m(l5j,D e ) bits. 

If Bob detects both events |0) and |1) in the measurement 
of the + basis, he decides one event with the probability 
■i. In the following, this measurement is described by the 
POVM {M ,M o ,Mi}. 

Error correction (7., 9.) In the step 7. and 9., Alice 
and Bob generate I + m bits with negligible errors 
from N bits X and X' by using one of the following 
protocols: (For example, I and m are choosen as 
l + m = Nri( " la+ * ) and m = m(V u V e ).) 
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Forward error correction They share N x (Z + 
m) binary matrix M e . Alice generates other 
Z+m bits random number Z, and sends M e Z+ 
X to Bob. Bob applies the decoding of the 
code M e to the bits M e Z + X — X' to extract 
Z, and obtain Z' . 

Reverse error correction Bob generates other 
Z + m bits random number Z, and sends 
AI e Z+' X to Alice. Alice applies the decoding 
of the code M e to the bits M e Z + X' - X to 
extract Z, and obtain Z' . 

As mentioned later, since this error correction cor- 
responds to a part of the twirling operation, their 
channel can be regarded as a Pauli channel from Al- 
ice to Bob in the forward case (from Bob to Alice 
in the reverse case). 

Privacy amplification (8., 10.) In the step 8. and 
10., Alice and Bob generate I bits from Z + m bits 
Z by using the following protocol. First, they gen- 
erate the same I x (I + m) binary matrix M p with 
the following condition: 

P{Z€lmA/J}<2- m (1) 

for any non-zero Z + m bit sequence Z . Next, they 
generate Z bits M p Z from I + m bits Z. 

Hence, combining the above error correction and the 
above privacy amplification, Alice can be regarded to 
send information by the code Im M e /M e (Ker M p ). 

The preceding researches 0, 0, H| analyze the security 
when the binary matrix M p for privacy amplification is 
chosen completely randomly. If we choose the binary 
matrix M p by the Toeplitz matrix[I3, [HI, we nee d less 
random number. This is because Toeplitz matrix requires 
only Z + m — 1 bits random number while completely 
random binary matrix M p does (Z + m)l bits random 
number. An Z x (I + m) binary matrix (X, /) is called 
Toeplitz matrix [Tt], [l8| when its element X = (Xij) is 
given by Z + m — 1 random variables Y±, . . . , Y;+ m _i as 

X-i t j • ^i+j — 1- 

Theorem 1 Toeplitz matrix satisfies the condition (QP 
for any element Z ^ € Fj"™. 

For a proof, see Appendix [A] 

III. EVALUATION OF EVE'S INFORMATION 
CONCERNING FINAL KEY 

A. Formulation of channel 

In this section, we assume a simplified Eve's attack, 
and evaluate the security against Eve's attack. In Section 



IVl we will treat the general case of Eve's attack, and 
prove that the general case can be reduced to the case of 
this section. 

First, we assume that Eve can distinguish the four 
states \n, 0), and |0, n) in + basis and |n, 0, x),|0,n, x) 
in x basis. Hence, the input system can be described 
by iV-th tensor product system H® N of TL := H 
Til © (ffl„>2H„ i+ ) © (ffin>2H„ :X ), where Ho is the one- 
dimensional space spanned by |0,0), Hi is the two- 
dimensional space spanned by |0, 1) and |1,0), 7i n ,+ is the 
two-dimensional space spanned by |n, 0), and |0,n), and 
H n .x is the two-dimensional space spanned by |n, 0, x) 
and |0,n, x). The output system is described by N-th 
tensor product space Tt® N of TLo®H.\. 

Then, the quantum communication channel from Alice 
to Bob is given by 



0E^fegw, (2) 

n e 



where Va{e) is the distribution of e when n is fixed. Such 
a channel is called Pauli channel. Here, n and e are 
given as follows: Each element ni of n = (m, . . . , n^) 
is chosen among 0, 1, (2, +), (2, x), . . .. Each element ei 
of e = (ei, . . . , ejv) is chosen as v or s when ni is 0. It 
is chosen among v, (0, 0), (0, 1), (1, 0), (1, 1) when m is 1. 
Otherwise, it is chosen among v, 0, 1. When n,- is or 1, 
the channel £ ei \ ni is defined as 



/ <0,0|p|0,0)|0,0)(0,0| if ei = v 
\ (0,0|p|0,0)p mte) i ifei = s 

/ |0,0)(0, 0|Tr P Wl pP Wl if ei =v 
\\N e >P Hl pP Hl (\N e >y otherwise, 



where 



Pmix,i :=-(|0,l)(0,l| + |l,0)(l,0|), 

W (x,z) ._ x x Z z , 

X]0,1> = |1,0>, X|1,0) = |0,1), 
Z|0,1) = -|0,1), Z|1,0> = ]1,0>. 



When ni is not or 1, the channel E ei \ n . is defined as 
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( \0,0)(0,0\Tr P P nni \ie i = v 

£ ei \ ni (p) ■= I (0,ni\p\0,ni)\0,m)(0,ni\ + (l,n i |p|l,ri,j)|l,n»)(l,n i | if e. t = 
[ (0,ni\p\0,ni)\l,m)(l,ni\ + (l,ni\p\l,ni)\0,ni){0,ni\ if e t = 1. 



The raw key is generated from detected pulses, which 
belong to the system Ti.\ on the Bob's side. Thus, 
we focus only on the pulse whose measurement value 
is not v. In the following, we consider the security 
from the final key distilled from raw keys of the + ba- 
sis. Hence, the generated state can be restricted to 
Ho © T~ti © (®n>2^n,+)- Thus, it can be assumed that 
our channel @ s J2s Pn{S){®f-\ £ ei\m) satisfies that each 
element ej of e = (ei, . . . ,cm) is not v. 



x\, . . . ,xn is sent by \x\, . . . ,xn) £ (C 2 )®^ via the fol- 
lowing qubit channel: 



(3) 



There is a relation between the error probability in the 
x basis and the security. 



Theorem 2 Define P p ^ M as the error probability by 
an arbitrary decoding when an information sent by the 
code (M e (KerM p ))- L /(ImM e )- L with the x basis via 



B. Security of known channel: no dark count case the qubit channel t2gVn(e)(®iLl £ 'e i \n i )(p)> where " : = 



Assume that the input state belongs to the subsystem 
Tin '■= 7~L 



n • — » i-ni * 



®7~i.n N labeled by n = (m, . . . , njv). Now, 
we classify the N input subsystems into three parts: 

Oth part: K°(n) := = 0}. 

1st part: K^n) := #{i\m = 1}. 

2nd part: K 2 (n) := #{i\n. t > 2}. 

In the 0-th part, Eve can obtain no information. That is, 
Eve's information is equal to Eve's information when the 
Alice's information is sent by the + basis via the qubit 
channel: 

£'.\o0>) ^-(xyx^t+xyx 1 )^. 

In the 2nd part, Eve can obtain all of Alice's informa- 
tion by the following method: Eve receives two-photon 
state. She sends one qubit system to Bob, and keeps 
the other qubit. After the announcement of the basis, 
Eve measures her system with the correct basis. Thus, 
Eve's information is equal to Eve's information when the 
Alice's information is sent by the + basis via the phase- 
damping qubit channel (pinching channel): 

for n > 2. This is because the channel is given by £' e .\r n + ) 
in the single photon case when Eve measures the sys- 
tem with the correct basis. Here, the presence or the 
absence of the error X is not so important for Eve's in- 
formation. This is because the probabilities concerning 
the action Z is essential, as is discussed in Appendix [Cl 
Therefore, Eve's information concerning total N bits is 
equal to Eve's information when the N bits information 



(n\, . . . ,njv)- When Alice sends I bits information with 
the code ImM e /M e (KerM p ) in the + basis via the same 
channel, the following relations hold. 

Define pfz]\M as ^ e fi na ^ Eve's state when Alice's in- 
formation is [Z] — M p Z . Then, Eve's information I Pf 
is given as the quantum mutual information: 



E\M P 



\Z]\M P 



\—E \ 

\PmJ 



D(p\\p r ) : =Trp(logp-lo g/ /) 



[Z] 



Pm v 



2 lP[Z]\M p - 



The quantum mutual information I E \ M satisfies that 

llt Mp <h{P% Wv ) + lP^\ Up , (4) 
where h(x) is defined as 



h(x) 



— x\og 2 x — (1 — x) log 2 (l — x) if < a; < 1/2 



1 if 1/2 <x<\. 

Hence, Eve's information per one bit is evaluated as 



l ls\M p ^ h ( P ph\M p ) , uVii 



< 



I ~ I 
We also obtain the following: 



P 



ph\M p - 



(5) 



mm 



F (P[Z]\M p 'Pfz>]\M p ) > 1 - 2P 



ph\M p 



( max ; ] \\ P[z]lMp - p [z , ]{Mp \\i < 4P p 4 Mp . 

™™ F (P[Z]\M p i~PM p ) > 1 - P ph\M p 



^\\P{Z]\M P -PM P \\1 < IP?* 



(6) 
(7) 

•^/..' '--^; ; ,/.. (8) 

ph\M p > ( 9 ) 
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as the 



where F(p,p') := Tr vVTpTF- Define Pj„ cc | Mp 
probability of successfully detecting the Alice's informa- 
tion [Z]. Then, the inequality 



succ\M p — 



1 - P 



ph\M p 



holds. 

Further, the concavity of h implies that 



^ J M P 1 E\M P 
Vh 1 E\M p 

^m p —t- ^ 



<K< s p; h \M P >- 



m V n pV* 
lYh M p r v h\M p 



^M p r ph\M p - 



(10) 

(11) 

(12) 



distribution p( ), then the inequality 



E P " 

*m t 



t=0 



holds. That is, the upper bound can be characterized by 
K(ft) and t. 

For a proof, see Appendix [Dl 



C. Security of known channel: dark count case 



The concavity of left hand side of I110\) holds concerning 

P ph\M p - ThuS ' 



^ M p r succ\M p 



y-i 



1 ^M p r v h\M p y L 



For a proof, see Appendix [C] As shown in Sec- 
tion [V] sending / bits information with the code 
lmM e /M e (Ker M p ) is equivalent with the combination 
of sending random number and forward error correction 
by ImM e and privacy amplification by M e (Ker M p ). 
Next, we focus on the average error probability 



, , ,,, with the minimum length decoding when an 

pn,mtn\M p ° ° 

information sent by the code (M e (KerM p ))- L /(ImM e )- L 
with the x basis via the qubit channel A(p) = 
YlePn{e)(®f = i£' e .i_ )(p)- This value is described as 



ph,min\M p 



i 



| (ImM e 



J2 E (AVn(\z){z\)\z')., 



where we take the summand concerning z' satisfying the 
following condition (fl3|) : 

argmin dis(z',z") £ (lmM e ) ± , (13) 

z"e(M c (KcrM p )) i 



and dis(z', z") is the Hamming distance between z' and 
z" . In order to analyze the error probability P p ^ m in\M 
we introduce the number t(e,ft): 

t{e, n) := = 1, e* = (0, 1) or (1, 1)}. 

Theorem 3 Assume that the binary matrix M p satisfies 
the condition (QJ). If the distribution Va takes positive 
probabilities only in the set {e|t(e, ft) = t}, then we obtain 

Further, if the stochastic behavior of the random vari- 
able t = tie, ft) on the distribution Vn is described by the 



Next, we take into account the effect of dark 
count in the detector. In this case, in order to 
characterize the presence or the absence of dark 
count, we add c or d to the label rij of the in- 
put system. That is, the label rij is chosen among 
(0, c), (0, d), (1, c), (1, d), (2, +, c), (2, +, d), (2, x , c), (2, x , d), . 
etc, where (*, d) expresses dark count and (*, c) does the 
normal count. Then, we can classify detected pulses to 
the following six parts: 

o = 0, J°(H): The number of detected pulses except for 
dark count whose initial (Alice's) state is the vac- 
uum state. 

o=l, J 1 (ft): The number of detected pulses except for 
dark count whose initial (Alice's) state is the single- 
photon state. 

o = 2, J 2 (ft): The number of detected pulses except for 
dark count whose initial (Alice's) state is the multi- 
photon state. 

o = 3, J 3 (ft): The number of pulses detected by dark 
count whose initial (Alice's) state is the vacuum 
state. 

o = 4, J 41 (ft): The number of pulses detected by dark 
count whose initial (Alice's) state is the single- 
photon state. 

o = 5, J 5 (ft): The number of detected pulses except for 
dark count whose initial (Alice's) state is the multi- 
photon state. 

Now, we consider the following protocol: First, Al- 
ice sends the random number with the + basis via 
J2s ^«(e)(®^=i£e;|TiJ(p), where for the dark counts m = 
(*,d), &i takes only d and the map £d\ ni is given by 
£d\ ni {p) = ^(|0, 1) <0, 1| + |1,0)<1,0|). Second, they ap- 
ply the forward or reverse error correction by the code 
Im M e , and finally perform privacy amplification by M p , 
where M p is assumed to satisfy ([1]). In this case, we ob- 
tain the same argument as Theorem [3J Thus, in order to 
discuss the security, we need to characterize the average 
error probability in the x basis. 
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Now, we consider the forward error correction case. In 
the event o = 0, 3, Eve cannot obtain any information 
of Alice's raw key. Also, in the event o = 2,4, 5, Eve 
can obtain all information of Alice's raw key. Thus, our 
situation is the same as the case of K 1 = J 1 and K 2 — 
J 2 + J 4 + J 5 of Theorem [3] Similar to the above subsec- 
tion, we define the average error probability P^ min _^\ M 

of the code (M e (KerM J ,)) 1 /(ImM e ) 1 concerning the x 
basis with the channel ^gVn(e){®f = i£' ei \ ni ){p), where 
we define the map £' e .\ n . for dark count m = (*,<f) as 
follows: S' d ,, t d ) is the same as f^l* an d 



F' 

C d\(0,d) 



(p) ^-(xVx^t + xVCx 1 )^, 



£'d\(*,d)(p) 



-(zVz^ + zyz 1 ^) 



for * 7^ 0. The distribution p( 



is defined as the 



distribution describing the random variable t — i(e, n) 
under the distribution Vn, and define t{e, n) by 

t(e, n) := #{i\rn = (1, c), e, = (0, 1) or (1, 1)}. 

Then, we obtain 

E P Vh 

Mp ph,min, — >\M P 



< j^pi 4) min { 2 ^(^)+^+./ 4 +J 5 -™ j j 

t=0 



(14) 



Next, we consider the reverse error correction case. We 
assume that the bits detected by dark count cannot be 
controlled by Eve. That is, in the event o — 3,4,5, Eve 
cannot obtain any information of Bob's raw key. Also, 
in the event o = 0, 2, Eve can obtain all information 
of Bob's raw key. (In the case of o = Q, Eve can ob- 
tain Bob's information by the following. Eve generates 
an entangled pair, and sends Bob a part of it. After 
announcing the basis, Eve measures the remaining part 
based on the correct basis.) Hence, our situation is the 
same as the case of K 1 = J 1 and K 2 = J° + J 2 of 
Theorem [3] Similar to the above subsection, we define 
the average error probability P^hmin *-\M °^ ^ e CO( ^ e 
(Af e (KerM p )) J -/(ImM e ) J - concerning the x basis with 
the channel Y^gPfiityi^iLi^'ein)' where we define the 
map £' e A ni as follows: 



F' 



(p) ^(xVx^ + xVtxY), 



^1(1,0)00 :-W e -p(W e t , 
1 



^|(*,C)(P) :=2(ZVZ°) , + ZVZ 1 ) t 

for * 7^ 1 
Note t 

{*,d) is different from the forward case. Here x 



Note that the definition of £' e .\ ni for dark count 



expresses the reverse case. Then, we obtain 



' L p ph,min,< — \M P 



<]T P (±)mm{2^ 



) + ./° + .7 2 -m 



(15) 



D. Security of unknown channel: dark count case 



Now, we back to the original setting. Since the num- 
bers J°, . . . , J 5 and the ratio r 1 :— -p- are unknown, the 
size of sacrifice bits is chosen as the function m(2?i,2? e ) 
of the random variable T> e . For simplicity, we abbreviate 



m('Di,'D e ) and r/(- 



i +k 



-N 



) to m and r\. 



Now, we give general security formulas for the given 
function m of T> e . The random variable n is known by 
Eve, but cannot be decided by Eve. Hence, Eve's in- 
formation is measured by the conditional expectations 
^e\m v pos °f ^e\m concerning the random variable n 
when the random variables M p ,V e , and POS are fixed, 
where POS is the random variable describing the posi- 
tion of the check bits and each kinds of pulses. We de- 
fine P ph, mi n,x\M p ,Ve,POS as the conditional expectations 
of P " . - concerning n when the random vari- 

ph,rain,x\M p ,J 

ables V e , and POS are fixed. Then, we obtain 



TfV TV 

Cj M p ,T>e,POS 1 E\M p ,T> c ,POS 



<E 



P ,POsh{Pph, min, x\V c , POs) 



Ep e ,POs(-^ 7 / — m )Pph,min,x\V c ,POS 



— Pph,av,x 



1-logP 



ph,av,x J i 



(16) 



where E^ 



. x) e ,POS ( e ? c: pos) denotes 
concerning the random variables M p ,T>, 
and POS). The inequality (fT6|) is proved in Appendix [El 
Hence, Eve's information per one bit can be evaluated as 



the expectation 
, and POS, (X> e , 



E 



X> c ,POS' 



E\T> C 



POS 



Nrj 



<E. 



De.POS" 



h{Pph\-D e ,POs) 

Nrj — m 



P 



ph,av,x 



< 



HPT h 



ph,av,x) 



N 



ph,av,x " 



Similarly, Eve's state can be given as the conditional av- 
erage Eve's state p 



when the random variables M p ,D, 



fz]\M p ,v e ,pos with the final ke y \ z \ 

and POS are fixed. 
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Then, 



E 



A/ p: -D e ,POS 



[zmz 



F (P[Z]i P[Z']\M P , T>e,POs) 



>1 — 9P^ 

— £il ph,av,x 

E M P ,X) C , POS r II^IMp^e.POS ~~ P[^']|M„,I> e ,POsl|l 



<4P^ 

— pli.av,x 



Em p ,X> c ,POS nl j n ^ ? (P[Z]|A/„,X' e .POS' Pm p ,v c ,pos) 

>1 - p p 

— ph,av,x 
E M p ,U e ,POS In 8i x ll^]|M p ,X' e .POS ~ PM p ,D e ,POslll 

<ip'P 

— ph,av,xi 

where pf^.i^POS is the average state of ^]| Mp)X , ei p OS 
concerning [Z], and := Eg e POS P^ |13e pog . We 

can evaluate the probability P^ ucc x i M v POS that Eve 
successfully detects the final key \Z\. 



■p-F pF 

fi M p ,X> e .POS-^suec.a: | M p 



<E 



M p ,V a , POS I V ^Jh,mm,K|Afp,-D e ,POS 



I - pv 

ph , min , 2; | M p ,X> e , P OS 



\ 2 

V / 2-('' Ar -™) j (17) 



< 



(v / ^ 7 U,v / r^F^+ ^/i - p^y^) , 



(18) 



expectation concerning J and t even if the other random 
variable V e is fixed. Hence, our purpose is choosing the 
size m of sacrifice bits based on the information T>i and 
V e . 

Since Alice chooses the positions of each kinds of pulses 
and check bits randomly as is discussed in Hayashi et al. 
[HI], the stochastic behavior of V e is given by hypergeo- 
metric distribution in the case of any extremal point V . 
In order to guarantee the security with the finite-length 
code, we have to calculate (fT9l) and ([20]) for the specific 
function m(T>i, T> e ). Since this task needs a large amount 
of calculation due to a large number of random variables, 
we treat it in another paper [l5l ]. 

In the beginning of this sec- 
tion, we assume that the states 
{|n,0)(n,0|, |0,n)(0,n|, |n,0, x)(n,0, x|, |0,n, x)(0,n, x|}„> 2 
can be distinguished by Eve. Now, instead of 
the above states, we focus on the other set 
of states {p]- + := 4|n, 0) (n, 0|, p\' + := 
E„<|0,n)(0,7i|,pJ' x := EnK>,0,x){n,0,x\,p\' x := 
J2 n s l n \0, n, x)(0,n, x|}„> 2 which can describe all sent 
pulses by the convex combination of theirselves with the 
states |0,0)(0,0|, |1,0)(1,0|, |0,1)(0,1|, |1, 0, x) (1, 0, x |, 
|0,l,x)(0,l,x|. Then, we can assume so stronger 
ability of Eve that Eve can distinguish all states of 
{Pi, Pi , Pi , Pi }n>2- In this case, we obtain the 
same argument as this section with replacing the former 
set by the latter set. The construction of s l n in the 
case of the phase-randomized coherent light is given in 
Hayashi 



where ([18)) follows from the concavity of left hand side of 

In order to guarantee the security, it is sufficient to 
show that the probability P^ h av x is quite small for any 
V . Since the quantity P^ h av x has the linear form con- 
cerning V, it is enough to treat P^ h av x when V is an 
extremal point. That is, the relation 

max ^ ^ ^ Pph,av,x 

V-. any conditional distribution 



= max P, 



vesv 



ph,av,x 



holds, where EV is the set of extremal points concerning 
the set of conditional distributions. From (fT4"|) and (fT5)) . 
these values are evaluated as follows. 



max Pit 



vesv 



ph,av, 



max PZ 



V££V 



ph,av, 



| 2 ./ 1 / l (^) + ./ 2 + ./ 4 + ^-™ jl | (19) 

^2 jl ^ +j0+j2 - m ,l}. (20) 



where t is the number of errors of the x basis in the 
event of o = 1. Here, we have to treat the conditional 



E. Security with two-way error correction 

Here, we should remark that the effects of dark counts 
and the vacuum states are helpful only when the error 
correction is one-way. If we apply a careless two-way 
error correction, these effects are not so helpful. That 
is, Eve has a possibility to access the information in the 
events o = 0, 2, 3, 4, 5. The main point of the two-way er- 
ror correction is the following: Consider the case where 
a reverse error correction is applied after a forward er- 
ror correction. In this case, the second error correction 
depends on (a prat of) Bob's syndrome. That is, he has 
to announce (a part of) his syndrome. Now, consider 
an extremal case, i.e., the case where Bob announces all 
of his syndrome. This case is equivalent with the case 
where Bob announces his syndrome after Alice transmits 
her information via a Pauli channel with the + basis. 

In the single-photon case, as is discussed in Appendix 
[Bl Eve's information contains all information concerning 
the flip action X on the + basis, which includes Bob's syn- 
drome. Hence, this information it is useless for Eve in the 
single-photon case. However, it allows Eve to access the 
information in the events o = 0,2,4,5 in the imperfect 
photon case. Eve knows the parts o = 2,4,5 concerning 
Alice's bits Z after the forward error correction by the 
code C C F^. She also knows the parts o = 0, 2 con- 
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cerning Bob's bits Z' after the forward error correction 
by the code C using Bob's syndrome. The channels in 
other parts o = 1, 3 can be regarded as the single-photon 
case with the channels: 



IV. ASYMPTOTIC KEY GENERATION RATE 



A. Asymptotic key generation rate with dark 
count effect 



^ i |(i, c) (p)=W e V(W e4 ) t 

Suppose that Bob can perfectly correct the error, i.e., 
his bits Z' is equal to hers Z . Eve knows the parts o = 
0,2,4,5 concerning Z. Now, we focus on the subcode 
C C F^ +j3 defined by 

C = {x e F 2 /1+j3 |( a; ,o J v_ (J1+J 3 ) ) e C}, 

where 0jv_(ji+j3) is the vector in the composite sys- 
tem of the parts o = 0,2,4,5. Then, Eve's state is 
equal to that in the case where Alice sends her infor- 
mation with the code C via the J 1 + J 3 -qubits chan- 
nel Le, p n(e) ®i:7ii=(l,c),(o,d) K^m' Therefore, our sit- 
uation is the same as the case of K 1 = J 1 and K 2 = 
J° + J 2 + J 4 + J 5 of Theorem [3 

Now, we proceed to the general case of two-way error 
correction, in which the final classical error correction 
code C u is chosen with the probability p(u), i.e., Alice 
decides the i-th code Ci depending on the i—1 syndromes 
of Bob, inductively. We define the average error proba- 
bility P" 



ph,min^\M p 



and the distribution p u {-jr) con- 
cerning the random variable 4r when the classical error 
correction code C u is chosen, where t is defined similar 
to subsection IIIIBI The relation 



J 1 



(21) 



holds. Applying Theorem [3] in the case of K 1 = J 1 and 
K 2 = J° + J 2 + J 4 + J 5 , we obtain 



E P v " 



5 -™,l}. (22) 



Thus, from (|21[) and (j2"2")l . the average error probability 
P v , a . i , , satisfies that 



ph,min,^\M p 



< £> ( * ) min ^H^+.f+ji+M-m^ 1 j (23) 

t=0 

Thus, we can derive the same argument as subsection 
MIDI Here, the choice of the sacrifice bit size m depends 
only on the data T>i and V e . If we choose the sacrifice 
bit size m using information u, there is a possibility to 
improve the above evaluation. 



From the discussion of the precious section, if we 
choose the number of sacrifice bits m as a larger num- 
ber than J 1 /i(r 1 ) + J 2 + J 4 + J 5 in the forward case, 
our final key is asymptotically secure. Hence, we call 
J^r 1 ) + J 2 + J 4 + J 5 = N - J x (l - %!)) - ( J° + J 3 ) 
the initial Eve's information in the forward case. Also, 
J^r 1 ) + J° + J 2 = N - j!(l - Mr 1 )) - (J 3 + J 4 + J 5 ) 
is called the initial Eve's information in the reverse case. 
Thus, the asymptotic key generation (AKG) rates for the 
detected pulses of the forward and reverse cases are equal 
to 



J\l~h(r 1 )) + J° + J 
N 

J 1 {l-h(r 1 )) + J 3 + J 4 + J 5 
N 



-(!-»?(«„,+)) 



(24) 



(l-r,(s v , + )), (25) 



respectively, when r](s U! +) is the coding rate of the clas- 
sical error correction code, where N := ^2 i=0 J% and s v ^+ 
is the average error probability of the detected pulses. 

In the asymptotic case, - +J N +J and J ^ J converge 
to pd and v(0)po in probability, respectively, where po is 
the counting rate of the vacuum pulse and po is the rate 
of the dark counts among sent pulses. Thus, when our 
pulse is generated by the distribution u, the initial Eve's 
informations in the forward and reverse cases are equal 
to 

N{1 - - ) (26) 



Pu,+ 



Pi' 



Pu,+ Pu,+ 



(27) 



respectively, where p v ,+ is the counting rate of the pulse 
with the + basis generated by the distribution is, q 1 is 
the counting rate of the single-photon states except for 
dark counts, and r 1 is the error rate of the x basis among 
the single-photon states detected except for dark counts. 
Hence, two important rates q 1 and r 1 are needed to be 
estimated. 

By taking into account the counting rate , the 
AKG rates for the sent pulses of the forward and reverse 
cases are equal to 

T - W)) + v(0) Po - ?v + (l - 77(fl„,+)) 



j . = Ki)gHi - ftp +pd -pu,+0- - fe±)) 



(28) 
, (29) 



respectively, where s v is the error rate of pulses gener- 
ated with the distribution v in the + basis. These rates 
are equal to those conjectured by BBL|l4[. Hence, the 
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difference between v \") po and gives those of the for- 
ward and reverse cases. 

By applying GLLPpJj-ILMQ formulas, the AKG rate 
is equal to 



I, 



i(Kl)g 1 (l-^ 1 ))-P,, + (l-^,+))), 



GLLP—ILM 



where q 1 is the rate of all detected single-photon states 
(containing states detected by dark counts), and r 1 is the 
error rate among all detected single-photon states in the 
x basis These are calculated as 



q 1 = q 1 +p D 
- r= rV+jpg 



<r + pd 

If we do not take into account the effect of dark counts, 
the AKG rates of the forward and reverse cases are cal- 
culated to 

J , = ^(1)7(1 - W)) + ^(0)PO - - V(Sv, + )) 

~" ' 2 

7 _ ^(1)7(1 - feF)) - P„,+ (l - 



and r 1 satisfy the equations: 

Pv,x = v(0)Po + v{l){p D + q 1 ) 



we obtain 



Pv:. 



I/(0)pd 



f?£> 



1/(1) 

X _ g^xPi/.x - |KO)Po ~ \v(\)pd 
Pu,x ~ M°)Po - v(l)p D 

Note that the counting rate p„.+ of the pulses generated 
by v in the + basis coincides with the counting rate p Vj x 
of the pulses generated by v in the x basis. In the case 
of ps ^ 0, r' can be calculated as 



PS 



1 - 2p S 

This is because when r 1 ' is the error probability among 
the single-photon states detected except for dark counts, 
the relation r 1 = ps(l — r 1 ) + (1 — psjr 1 holds. 



respectively. The AKG rate 1^ was conjectured by Lo 
[13| , and proved by Koashi [l!| independently. 

The discussion in subsection IIII El implies that the 
AKG rate 



1/(1)^(1 - Kr 1 )) + u(0)p D - p u , + (l - ti(8 u ,+)) 



can be attained by two-way error correction [2l|. Assum- 
ing that the coding rate of two-way error correction is 
equal to that of one-way error correction, we compare 
these AKG_rates. Since ^(l)? 1 ^ - Mr 1 )) + u(Q)p D > 
v{l)q\l - h{r 1 )) = u{l)(q\l - Mr 1 )) +p D (l - h$))) > 

Kijfo 1 +pd)(i - W-^rlir)) = f (i)F(i - W)), ™ 

have 

I-> > I-* > Igllp-ilm 

1^ > 1^ > 1^ > Igllp-ilm 



B. Mixture of the vacuum state and the 
single-photon state 

First, we assume that ps = 0. Now, we consider the 
distribution v taking probabilities only in the vacuum 
state and the single-photon state. Then, q 1 and the er- 
ror rate r 1 = r 1 of the x basis can be solved from the 
counting rate po of the vacuum states, the counting rate 
p„ jX of the pulses generated by v in the x basis, and the 
error rate s„.x of the same pulses as follows. Since q 1 



C. Approximate single-photon state 

Now, in the case of ps = 0, we discuss the distribution 
v taking probabilities not only in the vacuum state and 
the single-photon state but also in multi- photon states. 
Approximate single-photon state has this form. When 
we can generate pulses only with the distribution v, we 
have to treat the rates q 2 , and qi_ of counuts except for 
dark counts of the multi-photon states in the x and + 
bases and the error rates r\ and r\ of the multi-photon 
states detected in the x and + bases except for dark 
counts as unknown parameters as well as the rate q 1 of 
counts except for dark counts of the single-photon states 
and the error rates r 1 and r\_ of the x basis and the + 
basis of the single-photon states detected except for dark 
counts. Thus, the following equations hold: 

Pu,x 

=l/(0)po + u(l)(p D +q 1 )+ l/(2)(p D + ql) (30) 
Pu,+ 

=i/(0)po + vQ)(pd + q 1 ) + v(2)(p D + q\) (31) 

Si>,xPv, x 

= 2^(%0 + v{l)(-p D + r\q l ) + v{2)(\pd + r 2 x ql) 

(32) 

S v ,+Pv,+ 

= ^(0)p + v(1){\pd + r\q l ) + u(2)(±p D + r 2 + q 2 + ), 



(33) 
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where q 1 , q\ , and q 2 , belong to the interval [0, l—po], and The minimum ql nin and and the maximum 



and r 2 ^ do to the interval [0, 1] . The AKG rate 
is characterized by the minimum value of g 1 (1 — /i(r^)) 
with these conditions. Since it is difficult to calculate this 
minimum, we treat the symmetric case, i.e., the case: 



PD,r 2 x 



alized simultaneously when q\ = 1 
minimum of q x (\ — h(r\ )) is equal to q^mO- 



= 0. 



The 
«))■ 



Vv:. 



(34) 



Then, the minimum q^ n of q 1 and the maximum 
of r\ are given as 



q 1 - = 



Pv,x -pof (0) - v(2) 



1/(1) 



5PO^(0) 



W(l) 



poKo)-pbKi)-K2) 



Next, we consider how much AKG rate can be im- 
proved when we send pulses generated by different dis- 
tributions. For this purpose, we focus on the maximum 
qLo V of o 1 and the minimum r}„„ v of r\ , which are cal- 
culated as 



i _ Pu,x -Po^(0) ~ v{2)pp _ 

i . .i s v x p UjX - ^PoK ) - \p D v(l) - \p D v(2) - (1 - po)v{2) 

r ■ < r ■ .= — ■ . 

p v ,x —pov(0) ~PDv{l) - v(2)p D 

The difference between the maximum and the minimum are given as 

x _ x v(2)(l- PD ) 

y max "min ^ ( 1 ) 



max mm — max mm 



< l s»,xPv,x - ^Po^(O) - gggKl) " \pdv{ 2 ) - (! - Pd)v( 2 ) , ^(2)(1 -ffg) 

- rmax p„, x -Pof(o)-PDKi)-K2) p^,x -poKo)-poKi)-K2) 

(1 - pc)i/(2) / s„,xP,,x - 3P0KO) - \pdv{1) - \pdv{2) - (1 - p D )v(2) 



Pi/,x - Po^(0) - Pdv{\) - v(2) \ Pu,x~ Pov(Q) - PzjKI) _ K 2 ) 

I 



where the inequality 5^ = f xpr > f (1 — f ) is applied in 

the case of a = s u ,xPu,x — \pov{Q) — \pdv{1)—\pdv{2) — 
(1 - p D )v{2), b = p^x - po^(0) - Pdv(1) - v(2), and 
a; = z/(2)(l — Pd)- Hence, when these differences are small 
relatively with q m i n and r max , the AKG rate cannot be 
improved so much even though we send pulses generated 
by different distributions. For example, (1 — po)v(2) is 
small enough when the generated pulse is close enough 



to the single-photon. 

When the symmetric assumption (j3"4"|) does not hold, 
the conditions (j3Tj) and ([33]) are added with the con- 
ditions (|30|) and (|32|) . The maximums (j^ax an d r max 
become small, and the minimums q^ lin and rl nin become 
large. Hence, the following relations also hold even in the 
non-symmetric case: 



1 _ 1 M2)(l-p D ) 

ymax ymin — 



Ki) 



1 _ 1 (l-p/j)i/(2) f 1 t s v ,xPu,x ~ fpoK°) - \pdv{\) - \pdv(2) - (1 -p D )v(2) 

^ msv 'min — 



p o u{0) - Pdv{1) ~ i/(2) V Pu,x - Po^(0) - Pdv{\) - v(2) 



V. DETAIL ANALYSIS ON EVE'S ATTACK ing discussion contains the case when the frame of Alice 

A. Reduction to three-dimensional outcome 
channel 



We prove that any Eve's attack can be reduced by the 

nttfir'V HiQpnQQrrl in Slnrtinn ITTTI Of rnnren in tno fnllnw- 
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does not coincide with that of Bob. Since Alice sends N 
pulses and Bob receives N pulses, Eve's operation can 
be described by a CP-TP map £ jf from the system H® N 
to the system H® N . This description contains the loss 
of the communication channel. Even if the detector has 
the loss, if the loss does not depend on the measurement 
basis, the security is guaranteed by our discussion. 

In order to reduce the output system H to three- 
dimensional system Ho © H 1 , we modify our protocol as 
follows: In the measurement with the + basis, Bob per- 
forms the measurement {|n, m)} n , m . When (0, 0) is mea- 
sured, he decides his final outcome to be 0. When (n, m) 
is measured, he does his final outcome to be with the 
probability " , and 1 with the probability m . This 

POVM with three outcomes is denoted by {M , M , Mi} 
on the system H. First, we discuss the security based on 
the POVM {M0,M o ,Mi}, and after this discussion, we 
treat the security with the POVM {M , M , Mi}, which 
is given in Section [TTJ 

The stochastic behavior of the outcome of the POVM 
{M ,M o ,Afi} is described by the POVM {Mg := 
\0){0\,M := 11,0X1,01, M[ := |0,1)<0,1|} on the sys- 
tern Ho © Hi and the TP-CP map £, which are defined 
as 

TrM i p = Tre^(p) 

OO 

£ (p) := PuoPPno + Pn.pPu, + sn ( p n n pPnJ, 

n=2 

where the TP-CP map £ n from the n-photon system H n 
(which is equal to the n-th symmetric space) to the sys- 
tem Hi is defined by embedding the state p on the n-th 
symmetric space H n into n-tensor product system Hf n 
as 

£ n (p) : Tr 2 ,,p. 

where Tra,...,^ means taking partial trace concerning 2-th 
- n-th subsystems. 

Hence, by extending the system under Eve's control, 
the environment of the TP-CP map £ can be regarded 
to be under Eve's control. The channel from Alice to 
Bob can be described as the TP-CP map £® o £ N from 
the system system H® N to the system (H ®Hi)® N . We 
also assume a stronger ability of Eve, i.e., all states |n, 0), 
|0, n) |n, 0, x), |0,n, x) can be distinguished by Eve for 
n > 2. Then, each pulse can be described as a state on 
the system H' := Ho © Hi © (®£L 2 W„, + ) © (®™ =2 H n ,x), 
where the space H n .+ is spanned by {|n, 0), |0,n)}, and 
the space H n ,x is spanned by {\n, 0, x), |0,n, x)}. Then, 
the channel £® o £ N from Alice to Bob can be regarded 
as a TP-CP map from the system H'® N to the system 
(Ho © Hi)® N , which is denoted by £' N in the following. 



Now, we focus on following two pinching maps: 
£ a (p) :=Pu,pPh, + |0, 0) (0, 0|p|0, 0) (0, 0| 

OO 

+ £|n,0)(n,0|p|n, 0)(n,0| 

n=2 

+ \0,n)(0,n\p\0,n)(0,n\ 
+ |n, 0, x)(n, 0, x \p\n, 0, x)(n, 0, x | 
+ |0,n, x)(0,n, x|p|0,n, x)(0,n., x|, 
£ b (p) :=P Ha pPn a +PhiRPhi- 

By extending the system controlled by Eve, the channel 
from Alice to Bob can be regarded as a TP-CP map 
£n ■= £ b ° £'n ° &a from the system H'® N to the system 
(Ho © Hi)® N , due to the forms of the measurement by 
Bob and the states sent by Alice. 

B. Discrete twirling 

In order to define discrete twirling, we define the op- 
erators X and Z on the system system H' by 



X|0) = 


10) 




x| t> = 


II), X||) = |T> 




X|n,0> = 


|0,n), X|0,n) = |n,0) 




X|n,0, x) = 


n, 0, x), X 0, n, x) = 


- 0, n, x 


Z|0) = 


10) 




z|T) = 


||), z||) = (-i)|T) 




Z|n,0) = 


|n,0), Z|0,n) = -|0,ri 


) 


Z|n,0,x) = 


|0,n, x), Z|0,n, x) = 


71,0, X), 



and the operators X^ and Z z for i,ze F 2 by 

X x =X Xl ®---(g>X XN , Z z = Z Zl © •• •© Z ZN . 
It is known that if and only if the relation 

(X x Z z ) 1i £ N (X x Z z p(X x Z z ) ji )X x Z z = £ N (p) (35) 

holds for any x, z £ F^, £n has the form of Now, 
we define the discrete twirling £n of the map £n- 

£ *(p)--=^n E (x x z z ) f £N(x x z z P (x x z z y)x x z z . 

(36) 

The operation of 'discrete twirling' corresponds to the 
following operation: First, Alice generates two random 
numbers x, z £ F^, performs the operation X^Z 2 , and 
sends the state via the channel £n, and the classical in- 
formation x, z £ F2 via the public channel. Next, Bob 
performs the inverse operation (X X Z Z )^ to the received 
system. Since the TP-CP map £ has the covariance (|35[> . 
£ has the form ([2]). However, when Eve's system is ex- 
tended, the implemented channel £ is not £n but only 

£ N- 
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C. Forward case 

In the forward error correction case, by taking into ac- 
count the error correction operation, the raw keys can 
be regarded to be transmitted via the discrete twirling 
of the original channel. The operation concerning x 
in (|36[) is essentially realized by the following opera- 
tion. After quantum communication, Alice generates the 
random number X and sends the classical information 
Y = M e Z + X. Bob regards X' — Y as the final raw key. 
On the other hand, the input and output data are not 
changed when the operation corresponding to z. If Al- 
ice and Bob perform the operation concerning z in (|36[) . 
Eve's performance is increased only. Hence, in the for- 
ward case, the security can be evaluated by analysis on 
the channel ([2]). Note that since our error is symmetric 
in the form ([2]), the error probability can be estimated 
from the random variable T> e . 

When we take into account dark counts, any channel 
concerning pulses detected expect for dark counts, can 
be described by in the forward case. Eve can obtain 
all information when the sent pulse is not in the vacuum 
state but is detected by dark counts while he cannot ob- 
tain any information when the sent pulse is in the vacuum 
state and is detected by dark count. Hence, the analysis 
in Section [IIII is valid in the forward case. 



D. Reverse case 

We proceed to the case where all sent states are in 
single-photon and the reverse error correction is applied. 
Our protocol is given as follows. First, Alice sends the 
information bits X with the + basis to Bob via the quan- 
tum channel A, and Bob obtains the bits X' by measur- 
ing the received states with the + basis. Bob generates 
another random number Z , and sends the classical infor- 
mation Y = Z + X' to Alice, and Alice regards X — Y 
as the final raw keys. Now, we consider the following 
modified protocol: Alice generates an entangled pair and 
sends one part to Bob. Bob generates another quantum 
state with the + bit basis, and performs the Bell mea- 
surement {M( 0j o) i -^(0,1) > ^(i,o)) -^(1,1)} to the joint sys- 
tem of the received system and his original system, where 
M(o o)i M( i), M(! o), M(\ i) is the projection correspond- 
ing to ^(| )|0) + |1)|1)),^(|0)|0) - |1>|1», ^ (|0)|1) + 
|1)|0)),^=(|0)|1) - |1)|0», respectively. Then, he sends 
his measurement value to Alice. Alice performs the in- 
verse transformation depending on the data to her sys- 
tem, and measures it with the + basis. Since the map 
from Bob's input state to the Alice's final state satis- 
fies the covariance (|35p . this channel is described by the 
Pauli channel £(A) that is the discrete twirling of A. The 
latter protocol is essentially equivalent with the former 
protocol with the following modification: Bob sends Al- 
ice (0,0) and (0, 1) with the probability | in the case of 
Y = 0, and sends Alice (1,0) and (1,1) with the proba- 



bility ^ in the case of Y = 1. Hence, the channel from 
Bob to Alice in the former case can be described by the 
Pauli channel £(A). Therefore, without loss of generality, 
we can assume that the original map from Alice to Bob 
can be regarded as a Pauli channel. 

Now, in order to treat the loss during the transmission, 
we modify the latter protocol as follows. Alice performs 
the two- valued measurement {Tq,Ti} before sending one 
part of the entangled pair, and sends the state y/T\p\fT[ 
only when 1 is detected. In this case, the map from Bob's 
input state to the Alice's final state can be described by 
a Pauli channel. This protocol is essentially equivalent 
with the modification of the above former protocol with 
the following modification: Alice performs the two- valued 
measurement {To, Ti} before sending her state, and sends 
the state \fT\p\fT\ only when 1 is detected. This modi- 
fication is equivalent with the lossy channel case. 

Next, we consider the case where the number of pho- 
tons in the input state is not fixed and no dark count 
is detected. In this case, we assume that Eve can know 
Bob's measured value when n-photon state (n > 2) or 
the vacuum state is transmitted. It is needed only to 
describe the behavior of the counting rates and the error 
rates, which are estimated from the random variable T>i. 
Thus, we can assume that the channel from Alice to Bob 
can be described by @ without loss of generality. 

Finally, we consider the case with dark counts. Eve 
cannot obtain any Bob's information for the bits detected 
by dark counts. Hence, Eve's information concerning this 
part has no relation with the channel from Alice to Bob. 
Any description of this part is allowed. Thus, even if the 
dark counts exist, the channel from Alice to Bob can be 
described by j2|) without loss of generality. 

E. Security with the original POVM 

We compare the case with the measurement 
{M$,Mo,Mi} and that with the measurement 
{Mg, Mo, Mi}. The systems controlled by Eve in 
these two cases are identical. The error probability 
based on the measurement {M0,Mo,Mi} is larger than 
that based on the measurement {Mg,Mo,Mi}. Thus, 
the estimate of the error rate r 1 with the measurement 
{Mg, Mo, Mi} is larger than that with the measurement 
{M0,M o ,Mi}. Since a larger estimate of r 1 gives a 
larger size m of sacrifice bits, the security based on the 
measurement {Mg,Mo,Mi} implies the security based 
on the original measurement {Mg, M , Mi}. 

VI. CONCLUDING REMARKS 

Applying the relation between Eve's information and 
phase error probability, we have derived useful upper 
bounds of eavesdropper's performances, i.e., eavesdrop- 
per's information and the trace norm between the Eve's 
states corresponding to final keys for the protocol given 
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in section HU Here, we have used powerful relations be- 
tween the eavesdropper's performances and the phase er- 
ror probability. We have also treated our channel as a 
TP-CP map on the two-mode bosonic system, which is 
the most general framework. Further, our discussion has 
taken into account the effect of dark counts, which forbids 
Eve to access Bob's bits of the pulses detected by dark 
count. However, our upper bounds (TIT))) and (f2T))) con- 
tain so many random variables that its detail numerical 
analysis in the case of phase-randomized coherent light 
is very complicated and is separately given in Hayashi et 
al [15| . Hence, the future problem for practical QKD is 
the numerical calculations of the bounds (fT9|) and ([20)1 . 
On the other hand, the concrete calculation of the AKG 
rate is another future important topic. Also this topics 
is separately discussed in Hayashi jlq . 

We have treated the AKG rate more deeply when the 
generated imperfect resource is close to the single-photon. 
Since this resource is different from the perfect single- 
photon, we need the decoy method. We have compared 
the case where only the vacuum state is sent as a different 
pulse with the case where additional pulses are sent as 
different pulses. 

This paper has treated only the binary case. However, 
it is easy to extend to the p-nary case, where p is a prime. 
In this case, we replace the two-mode bosonic system and 
F 2 by the p-mode bosonic system and F p . 
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APPENDIX A: PROOF OF THEOREM [TJ 

Now, we prove Theorem [1] More precisely, we show 
the following. (1) An element (x,y) T e F^eFj belongs 



the image of (X, I) T with the probability 2 - ™ 1 if x ^ 
and y ^ 0. (2) it does not belong to the image of the 
transpose of any I X (I + m) Toeplitz matrices (X, I) if 
i^O and y = 0. 

Indeed, since (2) is trivial, we will show (1). For y = 
{yii ■ ■ ■ i Urn), we let i be the minimum index i such that 
yi ^ 0. An element (x, y) T £ F^eF^ belongs to the 
image of (X,/) T if and only if (x,y) — (K T y,y), which 
written as the following m conditions. 



I 

Yiy % = xi - Y y - x x 
j=»+i 
i 

Y i+1 yi = x 2 - ^2 Yj+iVj ~ xi 



I 

Yi+m-lVi = %m-l ~ J]] Yj+m-iVj — %1 
j=i+l 
I 

Yi+rn—\Vi — X m ^ ^j'+m— lVj X\ 
j=i+l 



Now, the random variables Yi+ m , . . . , Y/+ m -i are fixed. 
The m-th condition does not depend on the variables 
Yi, . . . Yi+m-%. Hence, the m-th condition only depends 
on the variable Yi+ m -\. Therefore, the m-th condition 
holds with the probability 1/2. Similarly, we can show 
that the m— 1-th condition holds with the probability 1/2 
when the m-th condition holds. Thus, the Z-th condition 
and I — 1-th condition hold with 1/2 2 . Repeating this 
discussion inductively, we can conclude that the all m 
conditions hold with the probability 2~ m . 



I 

APPENDIX B: EVE'S STATES 



For any Pauli channel £(p) = ztF 1 P{ x i z)X x Z z p{X x Z z y , the channel to Eve is given by £e{p)- 



£e{p)-= VPi^)VP(x',zi)TrX x Z z p(X*'z z 'y\(x,z))((xi 7 z')\. 
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If the input state is given by \y) in the + basis, Eve's state can be evaluated as follows. 

£ E (\y)(y\) 

= E ^p^^pj^)(y\z^'\y)\(x,z))((x,z')\ 

x£F l 2 ,z,z'£F l 2 

= Yl z))({x, z')\ 

xeF l 2 ,z,z'eF 2 

= P{x)\P,y,x){P,y,x\, 



(Bl) 



where we define the vector |P, y, x) as 

\P,y,x) := J2 (-iy y VPW)\(x,z)). 



z£F< 



That is, Eve's state is the stochastic mixture of the state 
\P,y,x)(P,y,x\ with the probability P(x). Then, Eve 
loses no information even if she measure the information 
x concerning the error of the + basis. 



APPENDIX C: PROOF OF THEOREM H 

The inequalities ([4]) and ([5]) are proved by Hayashi [l(| • 
First, we prove the inequalities ([6|), (0, (O, and {9]). As 
is similar to the inequalities (j4|) and (0, it is sufficient to 
show these inequalities for the corrected channel. This is 
because the code ImM e /M e (KerM p ) with the + basis is 
equivalent with the code (M e (KerM p ))- L /(ImM e )- L with 
the x basis [1(3]. Thus, it is sufficient to show 

min F(£ E {\ y }{y\),£ E (\y'){y'\)) > 1 - 2Pph (CI) 

y.y'£F 2 



max \\£ E (\y)(y\) - £ E (\y')(y'\)\\i > AP ph 
y,y'eF l 2 

> 1 - P, 



min F(£ E (\y)(y\),Pn 



ph 



max \\£ E (\y)(y\) - p mix \\i > P ph , 
yeF' 2 



(C2) 
(C3) 
(C4) 



where p m ix is the maximally mixed state and the phase 
error probability P p h is defined as 



P, 



x,z£F l 2 ,z^0 x£F' 2 



Since ||p-p'||i > 2 i l ~ f (p> P')), the inequalities (jC2j) 
and (IC4|) follow from (jCip and (|C3|) . Now, we will prove 
([CTjl and ((U3|) . Remember the relation (jBTj) . Since 

KP,j/^|P,y',x)| = | ]T (-ir^P(z|x)| 

>p(o|x)-i (-ir {y '- y) p(z\x)\ 

z£F l 2 ,z^0 

=P(0\x) - (1 - P(0|x)) = 2P(0|.t) - 1, 



the fidelity F(£ E (\y){y\),£ E (\y'){y'\)) can be evaluated 
as 

F(£ E (\y)(y\),£ E (\y')(y'\)) = E P(x)\ (P, y, x\P, y' , x)\ 

x£F l 2 

> P(x)(2P(0\x) - 1) = 2 E P(x,0) -1 = 1- 2P p/l , 

x£F 2 x£F' 2 

which implies (|C1|) . Since 

(P,y,x\(^ Y \Py',x)(Py',x\)\P,y,x) 



y'£F' 2 



(P,y,x\{J2 P(z\x)\(x,z))((x,z)\)\P,y,x) >P(0\x) 2 , 



z£F' 



we have 



F(£ E (\y){y\), E ±£ E (\y'){y'\) 



y'£F 2 



= E p w 



x£F' 



\ 



(P,J/,x|(-f E |P,y',:r)(P,y',:z|)|P, 



> E ^(x)P(0|x) = £ P(x,0) = 1 - P s 



x£F' 



x£F' 



which implies (|C3|1 . 

Next, we show (|10p . The discrimination on the set 
of states {£E{\y}(y\)}y£F!, can b e reduced to The dis- 
crimination on the set of states {\P,y,x){P,y,x\y y ^ F i^. 
This set has a symmetry concerning the action of 
ij G F< as IV := E^Fst- 1 )""'!^ Each 
one-dimensional subspace spanned by z)) is differ- 
ent representation subspace in the space spanned by 
{|(a;, z))} zeF i. From Holevo(20l|'s theory of covariant es- 
timator, the minimum average error is given by the fol- 
lowing covariant POVM {2~ z J7 a |0) (0|Z/t} 5 where \<j>) = 
J2z£F l 2 e%9 * l( x > Then, the correct-decision probabil- 
ity is given as 



2-'|(P,0, : 



= 2 



-/ 



E ^p^y 



z£F< 



1G 



Its maximal value is (X)zgf? V P( z \ x ) y ^2~ 1 ) 2 > which is 
attained when e l6z = 1. Therefore, the optimal correct- 
decision probability of the set {£E{\y)(y\)} yf =F l ^ s equal 

to J2xeF l 2 ^)(E z6 f| /P(^)V2^) 2 . 

Since (J2 z eF l y^^Rv^) 2 is the fidelity between the 
uniform distribution and the distribution P, the joint 
concavity of the fidelity guarantees that the concavity 
of (Ezgf' \/-P(-z)V2 _/ ) 2 concerning the distribution P. 
Thus, 



i£F' 



z£F' 



<(E JE p (M^)' 



no bits: no noise (Oth part). 

n\ bits: ai mosi t bits will be changed (1st part). 

ni bits: no assumption (2nd part). 

Using the above classification, Bob recovers the original 
information for received information y by the following 
way. First, he defines the element T(y) S C2(X) by 

T(y) := argmax \wi(y - z)\, 

z£C 2 (X):n (y)=Tr (z) 

where ni is the projection to the above ni bits. Next, Bob 
recovers the information [T(y)] c j_ G Cz(X) /C± . 
Then, we obtain 



zeF' 2 y xeF l 2 
The concavity guarantees that 

max (V JFuSV^Y 



E x p x {[r(y)] c x ^ [x 



} 



(D2) 



z£F' 



P:P(0) = 1 

= ( E ^J^pVhVt 



(2 l i; 



zeF' 



Pph 

2 l -l 

2 



for any [x] c ± G CiiX)^ jC^ , where p x is the conditional 
distribution describing the distribution of the output y 
with the input x satisfying the above condition. 

Proof: From the linearity, 

fe{[r(2/)] c - + Wc-} =Po{[r(2/)] c x ± [o] c x} 
=Po{r(y) i ci). 



which implies (|10p . 

Applying the concavity of (J2 z ef 2 V 'P(z)V2~ 1 ) 2 be- 
tween the distributions (1 — Pph-, 



2^1 > ' 



(1 — P'ph, orffi ■ ■ ■ ' 2^1 )' we obtain the concavity of 



Hence, it is enough to show 



(D3) 



(VPp~h~Vi - 2- 1 + ^T^Pj 



ph 



concerning Pp^. 



APPENDIX D: PROOF OF THEOREM H 

Since the condition Z G (M e Ker Mp) 1 - is equivalent 
with the condition A/JZ G ImAfJ for Z G F^, the 
condition (|TJ) is equivalent with the condition: 

P{Z G (M e KerMp)- 1 } < 2-™ for VZeFf\ (ImAfe)- 1 . = ^ p (y)Px \X 

yey ^ 



When the original massage is 0, the received signal y 
satisfies the conditions 7To(w) = and |7ri(w)| < t, i.e., 
the distribution po has positive probability only on the 
set y := {y\TT (y) = 0, \wi(y)\ < t}. Then, 

E xPo {r(y) i Ci) 

=E xPo {y|3z G C^X)^ \ C i L s.t.|7ri(z) - m(y)\ < My)|} 

<E xPo {y\3z G CaCX) 1 - \ C^s.t.Mz) - m(y)\ < t} 

3zeC 2 (X)^\C't 
s.t.|7ri(z) - m(y)\ < t 



Hence, Theorem [3] is essentially equivalent with the fol- 
lowing proposition, which we will prove. 

Proposition 1 Let C\ C F^ be an I + m- dimensional 
code. We choose an m-dimensional subcode C2(X) C C\ 
satisfying the following condition: 

P x {X\x G C 2 (X) ± } < 2~ m for \fx G F£ \ , (Dl) 

where X is the random variable describing the stochastic 
behavior. Alice sends the information C2(X)- L /C^ via 
the following channel. Here, when she wants to send the 
information [x] c ± G C2(X) ± / , she chooses x' among 

x + with the equal probability 2 l+m - N '. The total N 
bits can be divided to the following three parts: 



<E^°(y) E Px{X\zeC 2 (X^\Ct} 

yey Z :|7ri(z)— ;ri(»)|<i 

<£**>(») E 2 ~ m 

yey z:\7T 1 (z)-7T 1 {y)\<t 



<£p (2/)2' 
yey 



(D4) 
(D5) 



where the inequality (|D4|) follows from (|D1[) and the in- 
equality (|D5[) does from the following inequality: 



|{z|| 7 r 1 (z)-7r 1 (y)|<OI<2" l/l( ^ )+ " 2 . 
Therefore, we obtain (ID3I). 
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APPENDIX E: PROOF OF (fl6|) where the last inequality follows from the concavity of 

> 2 



Since — (1 — x) log(l — x) < x, we have 

h(Pph,min,x\V B ,POs) + Ex^poS^ 7 ? — m ) P ph,min,x\V c ,POS 
— ~ Pph,min,x\V e ,POS^°S(Pph,min,x\V e ,POs) 

+ Pph,min,x\V e ,POS + ^ Pph,min,x\V e ,POS 
=P ph,min,x\V c ,POs(^ + 1 — l°g Pph, rain, x|D c ,POs)- 

Thus, using the concavity of the function x — > — xlogx, 
we obtain ([TBI). 



APPENDIX F: PROOF OF (fl5|) 

We will prove (fT8|) . First, the function g i— > /(q) := 
^/l — p^/9+^-v/l — 9 is monotone increasing for g < 1/2 
when p < 1/2. This is because the derivative is calculated 

^f'(Q) = l(\f I ^-^)<0. Thus, 



E M p ,X> c ,POS ( J P ph,min,x\M v ,T> e ,POs' S ^ 2 



-(■nN-m) 



\ 2 

+ Jl-P v h ■ ,„ „ pm V2-W-'") 

^ E M p ,X> c ,POS ( J P ph,min,x\M p ,V c ,POS^ 1 ~ 2 ~~ 



1 - P 73 x/F^ 

± 1 P (i,min,j|M p ,B e ,POS V 



'l - pp. V^K 

ph,av,x 



r P p ~h~Vl - 2-' + ^/l - P ph V¥-t) concerning P p/l . 
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